iptables 1.3.7 과 커널 2.6.21 에서의 문제점

랜포트를 2개를 운영중으로 WAN 포트는 인터넷에 LAN 포트는 내부망으로 DHCP 서버로 운영하여
LAN 포트를 통해 IP 를 받은 PC 들이 WAN 포트를 통해 인터넷에 나가도록 하려 합니다.
iptables-1.3.7 을 컴파일하고 커널 옵션에서 MASQUERADE target support
를 선택해 커널에서 지원되도록 했는데 이상한 현상이 발생합니다.

MASQUERADE 체크 후 커널이미지를 만들면
- LAN 포트와 LAN 포트와 연결된 PC 와 ping 조차 안됩니다. (ifconfig 은 정상)
- iptables 명령은 실행됩니다.

MASQUERADE 해제 후 커널이미지를 만들면
- LAN 포트와 LAN 포트와 연결된 PC 와 Ping 이 됩니다.
- 당연히 iptables 명령에서 커널옵션을 추가하라는 에러가 출력됩니다.

커널 옵션에서 뭔가가 빠졌거나 추가를 해야하는것 같은데
도움 부탁드립니다.

아래는 커널옵션에서 제가 선택한 옵션입니다.
===============================================================
Networking option -->
===============================================================
[ ] Network packet debugging
<*> Packet socket
[ ] Packet socket: mmapped IO
<*> Unix domain sockets
< > Transformation user configuration interface
[ ] Transformation sub policy support (EXPERIMENTAL)
[ ] Transformation migrate database (EXPERIMENTAL)
< > PF_KEY sockets
[*] TCP/IP networking
[ ] IP: multicasting
[ ] IP: advanced router
[ ] IP: kernel level autoconfiguration
< > IP: tunneling
< > IP: GRE tunnels over IP
[ ] IP: ARP daemon support (EXPERIMENTAL)
[ ] IP: TCP syncookie support (disabled per default)
< > IP: AH transformation
< > IP: ESP transformation
< > IP: IPComp transformation
<*> IP: IPsec transport mode
<*> IP: IPsec tunnel mode
<*> IP: IPsec BEET mode
<*> INET: socket monitoring interface
[*] TCP: advanced congestion control --->
[ ] TCP: MD5 Signature Option support (RFC2385) (EXPERIMENTAL)
< > The IPv6 protocol
[ ] Security Marking
[*] Network packet filtering framework (Netfilter) --->
DCCP Configuration (EXPERIMENTAL) --->
SCTP Configuration (EXPERIMENTAL) --->
TIPC Configuration (EXPERIMENTAL) --->
< > Asynchronous Transfer Mode (ATM) (EXPERIMENTAL)
< > 802.1d Ethernet Bridging
< > 802.1Q VLAN Support
< > DECnet Support
< > ANSI/IEEE 802.2 LLC type 2 Support
< > The IPX protocol
< > Appletalk protocol support
< > CCITT X.25 Packet Layer (EXPERIMENTAL)
< > LAPB Data Link Driver (EXPERIMENTAL)
< > Acorn Econet/AUN protocols (EXPERIMENTAL)
< > WAN router
QoS and/or fair queueing --->
Network testing --->

=============================================================
IP: Netfilter Configuration --->
=============================================================
<*> IPv4 connection tracking support (required for NAT)
[ ] proc/sysctl compatibility with old connection tracking
< > IP Userspace queueing via NETLINK (OBSOLETE)
<*> IP tables support (required for filtering/masq/NAT)
< > IP range match support
< > TOS match support
< > recent match support
< > ECN match support
< > AH match support
< > TTL match support
< > Owner match support
< > address type match support
< > Packet filtering
< > LOG target support
< > ULOG target support
<*> Full NAT
<*> MASQUERADE target support
< > REDIRECT target support
< > NETMAP target support
< > SAME target support
< > Basic SNMP-ALG support (EXPERIMENTAL)
< > Packet mangling
< > raw table support (required for NOTRACK/TRACE)
< > ARP tables support


=============================================================
Core Netfilter Configuration --->
=============================================================
< > Netfilter netlink interface
<*> Netfilter connection tracking support
Netfilter connection tracking support
[ ] Connection tracking flow accounting
[ ] Connection mark tracking support
[ ] Connection tracking events (EXPERIMENTAL)
< > SCTP protocol connection tracking support (EXPERIMENTAL)
< > Amanda backup protocol support
< > FTP protocol support
< > H.323 protocol support (EXPERIMENTAL)
< > IRC protocol support
< > NetBIOS name service protocol support (EXPERIMENTAL)
< > PPtP protocol support
< > SANE protocol support (EXPERIMENTAL)
< > SIP protocol support (EXPERIMENTAL)
< > TFTP protocol support
--- Netfilter Xtables support (required for ip_tables)
< > "CLASSIFY" target support
< > "MARK" target support
< > "NFQUEUE" target Support
< > "NFLOG" target support
< > "TCPMSS" target support
< > "comment" match support
< > "connbytes" per-connection counter match support
< > "connmark" connection mark match support
< > "conntrack" connection tracking match support
< > "DCCP" protocol match support
< > "DSCP" match support
< > "ESP" match support
< > "helper" match support
< > "length" match support
< > "limit" match support
< > "mac" address match support
< > "mark" match support
< > IPsec "policy" match support
< > Multiple port match support
< > "pkttype" packet type match support
< > "quota" match support
< > "realm" match support
< > "sctp" protocol match support (EXPERIMENTAL)
< > "state" match support
< > "statistic" match support
< > "string" match support
< > "tcpmss" match support
< > "hashlimit" match support